https://community.splunk.com/t5/Splunk-Search/Error-in-lookup-command-Could-not-find-all-of-the-specified/m-p/90118#M23109 <P>I created a look up table that does return all the fields if I use the search command:</P> <P>|inputlookup lookuptable</P> <P>But I use the lookup command I get the following error:</P> <P>Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table.</P> <P>This is related to this thread:</P> <PRE><CODE><A href="http://splunk-base.splunk.com/answers/38321/could-not-find-all-of-the-specified-lookup-fields-in-the-lookup-table" target="test_blank">http://splunk-base.splunk.com/answers/38321/could-not-find-all-of-the-specified-lookup-fields-in-the-lookup-table</A> </CODE></PRE> <P>How can I solve this?</P> <P>Thanks for your time.<BR /> Lp</P> Mon, 15 Oct 2012 14:04:37 GMT lpolo 2012-10-15T14:04:37Z https://community.splunk.com/t5/Splunk-Search/Error-in-lookup-command-Could-not-find-all-of-the-specified/m-p/90118#M23109 <P>I created a look up table that does return all the fields if I use the search command:</P> <P>|inputlookup lookuptable</P> <P>But I use the lookup command I get the following error:</P> <P>Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table.</P> <P>This is related to this thread:</P> <PRE><CODE><A href="http://splunk-base.splunk.com/answers/38321/could-not-find-all-of-the-specified-lookup-fields-in-the-lookup-table" target="test_blank">http://splunk-base.splunk.com/answers/38321/could-not-find-all-of-the-specified-lookup-fields-in-the-lookup-table</A> </CODE></PRE> <P>How can I solve this?</P> <P>Thanks for your time.<BR /> Lp</P> Mon, 15 Oct 2012 14:04:37 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-lookup-command-Could-not-find-all-of-the-specified/m-p/90118#M23109 lpolo 2012-10-15T14:04:37Z https://community.splunk.com/t5/Splunk-Search/Error-in-lookup-command-Could-not-find-all-of-the-specified/m-p/90119#M23110 <P>Have you tried the suggested work arounds in the answers link that you posted? Have you checked for hidden characters? Was this lookup table ever working?</P> Mon, 15 Oct 2012 14:33:32 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-lookup-command-Could-not-find-all-of-the-specified/m-p/90119#M23110 RicoSuave 2012-10-15T14:33:32Z https://community.splunk.com/t5/Splunk-Search/Error-in-lookup-command-Could-not-find-all-of-the-specified/m-p/90120#M23111 <P>I have tried and it does not work. My file csv is clean. Using vi I checked if there was any hidden character. I could not find any. I just see $ sign at the end of each line.</P> Mon, 15 Oct 2012 15:18:37 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-lookup-command-Could-not-find-all-of-the-specified/m-p/90120#M23111 lpolo 2012-10-15T15:18:37Z https://community.splunk.com/t5/Splunk-Search/Error-in-lookup-command-Could-not-find-all-of-the-specified/m-p/90121#M23112 <P>I was able to solve the problem with the following steps:</P> <P>-. open the lookup file with vi. Then, look for hidden characters ":set list". You should only see this hidden character at the end of line "$". Delete, any hidden character that is not part of your text lookup file. Then, save the file and try to use the lookup command. <BR /> -. If the previous step does not fix the problem. cat you csv file. You should only see the text content of the file. </P> <P>I found this in my csv file:</P> <P>cat feeds.csv<BR /> <STRONG></STRONG>FeedType,MaxHoursOld</P> <P>I delete <STRONG></STRONG> by deleting "FeedType" and re-writing it. I saved the file and my lookup command worked as it should.</P> <P>Lp</P> Mon, 15 Oct 2012 16:22:00 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-lookup-command-Could-not-find-all-of-the-specified/m-p/90121#M23112 lpolo 2012-10-15T16:22:00Z https://community.splunk.com/t5/Splunk-Search/Error-in-lookup-command-Could-not-find-all-of-the-specified/m-p/90122#M23113 <P>Good job! Now the real question is why those characters were added. Are you by chance editing that lookup table with excel or some other app?</P> Mon, 15 Oct 2012 16:43:10 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-lookup-command-Could-not-find-all-of-the-specified/m-p/90122#M23113 RicoSuave 2012-10-15T16:43:10Z https://community.splunk.com/t5/Splunk-Search/Error-in-lookup-command-Could-not-find-all-of-the-specified/m-p/90123#M23114 <P>The lookup file was initially edit with notepad.</P> Tue, 16 Oct 2012 15:14:14 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-lookup-command-Could-not-find-all-of-the-specified/m-p/90123#M23114 lpolo 2012-10-16T15:14:14Z